Additional Parameter sets for HSS/LMS Hash-Based Signatures
draft-fluhrer-lms-more-parm-sets-17

IANA review: We understand that this document will require one registry action. However, the IANA Considerations section needs one change, and might benefit from another.

The first paragraph says, "This section should be removed before publishing as an RFC," but the second paragraph has an action for us, so we need to keep this section in place.

The second paragraph is a little confusing, and also doesn't need to tell us to update the references, because we'll do that anyway. I'd recommend something like this instead (which keeps most of the original language intact), if this is the action you want:

"IANA has assigned the code points for all the additional parameter sets in Section 3 (in the IANA "LM-OTS Signatures" registry) and in Section 4 (in the IANA "Leighton-Micali Signatures (LMS)" registry). These assignments are also included in NIST SP 800-208, but the IANA registrations should refer to this document alone."

(We could point to the NIST spec as well, though, if that would be useful/appropriate.)

[Ballot comment]
I didn't check Appendix A.

## Nits

2: interoperability keywords are not used in this document.  This
section can be deleted.  (It uses incorrect boilerplate as well.)

5: "id is the IANA-defined identifier used to denote this specific
parameter set, and which appears in both public keys and signatures."

(spurious "and")

9: "that attack allows the attacker can compute the hash of the
message"

Sentence.

9: "(because he can compute that anyways)."

Please avoid gendered pronoun.

Mallory Knodel reviewed for the IRSG on 2024-08-31; Colin Perkins forwarded review to authors on 2024-09-10. A revised draft will be needed to address review comments.

Technical Summary
The document specifies the way of SHAKE256 (with 192 or 256 bit output) and SHA256 (with 192 bit output) usage with LMS signature scheme defined in RFC 8554. It introduces new parameter sets and corresponding IANA identifiers and provides the guide to choosing the specific parameter set based on practical and security considerations. All the parameter sets match the parameter sets introduced in NIST SP 800-208 ("Recommendation for Stateful Hash-Based Signature Schemes"). The security analysis (Section 9) was significantly extended compared to the earlier versions of the draft and to the corresponding section in the NIST document. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Research Group Summary
The document was adopted in December 2021.
There was a Research Group Last Call for the draft in 2024 (January-April). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited in 2024 (January - April). The reviews were provided by Thomas Pornin, Russ Housley, Virendra Kumar. Comments from that review were addressed in -09, -10, -11 and -12.

Document Quality
There are several publicly available implementations: https://github.com/cisco/hash-sigs/tree/192, Utimaco, Crypto4A, https://github.com/russhousley/pyhsslms
All authors of the document have confirmed that they are not aware of any IPRs related to the document.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Colin Perkins is the IRTF Chair.

Technical Summary
The document specifies the way of SHAKE256 (with 192 or 256 bit output) and SHA256 (with 192 bit output) usage with LMS signature scheme defined in RFC 8554. It introduces new parameter sets and corresponding IANA identifiers and provides the guide to choosing the specific parameter set based on practical and security considerations. All the parameter sets match the parameter sets introduced in NIST SP 800-208 ("Recommendation for Stateful Hash-Based Signature Schemes"). The security analysis (Section 9) was significantly extended compared to the earlier versions of the draft and to the corresponding section in the NIST document. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Research Group Summary
The document was adopted in December 2021.
There was a Research Group Last Call for the draft in 2024 (January-April). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited in 2024 (January - April). The reviews were provided by Thomas Pornin, Russ Housley, Virendra Kumar. Comments from that review were addressed in -09, -10, -11 and -12.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Colin Perkins is the IRTF Chair.

The draft specifies the way of SHAKE256 (with 192 or 256 bit output) and SHA256 (with 192 bit output) usage with LMS signature scheme defined in RFC 8554. It introduces new parameter sets and corresponding IANA identifiers and provides the guide to choosing the specific parameter set based on practical and security considerations. All the parameter sets match the parameter sets introduced in [NIST_SP_800-208].

The security analysis (Section 9) was significantly extended compared to the earlier versions of the draft and to the corresponding section in [NIST_SP_800-208] document.